Age is probably one of the metrics that could take the longest to abuse, since it directly goes against the instant-gratification that the agent-runners are looking for. Requiring the a repo be around for a couple months doesn't sound too bad.

Someone might grab an old repository and just keep force-pushing new content and thus repurposing it, but if you can find a quick check against that (probably a log somewhere), I think it has a fairly good chance of weeding out the noise.